Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 04:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-11_58025adfcb7e51ef74a0e9f503e32fc9_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-07-11_58025adfcb7e51ef74a0e9f503e32fc9_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-11_58025adfcb7e51ef74a0e9f503e32fc9_mafia.exe
-
Size
529KB
-
MD5
58025adfcb7e51ef74a0e9f503e32fc9
-
SHA1
2e2ca416ffa955b00ab611fd1b3278335879390d
-
SHA256
705dcc592ae4f7e09938dc1c50349f183cac762f61fb1c9218000989a2a9d0b6
-
SHA512
7f233e925fdd3a294bbcff4a25e7092c814eb0790fcd182303679839c9968b18c131c436b9bda9c8c2fcc73e286d0954c0dd62ad8ff5a9c943a47d59cf3f84ff
-
SSDEEP
12288:NU5rCOTeijG9GanN04HlAqe6TZwlH4Hp:NUQOJjG9GM+YACTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1784 ABA1.tmp 2260 AC2E.tmp 2448 ACAB.tmp 3628 AD28.tmp 1108 ADA5.tmp 2692 AE22.tmp 2004 AE9F.tmp 1312 AEED.tmp 3996 AF5A.tmp 2680 AFD7.tmp 348 B026.tmp 2736 B083.tmp 2348 B0E1.tmp 4744 B12F.tmp 5016 B19D.tmp 2860 B20A.tmp 4484 B277.tmp 4960 B2C5.tmp 4852 B333.tmp 2320 B381.tmp 644 B3CF.tmp 2228 B41D.tmp 4224 B4AA.tmp 2376 B4F8.tmp 1016 B546.tmp 4648 B5B3.tmp 4712 B602.tmp 4992 B66F.tmp 4448 B6DC.tmp 940 B759.tmp 4296 B7B7.tmp 1520 B824.tmp 3404 B882.tmp 5000 B8E0.tmp 3692 B93E.tmp 2276 B98C.tmp 2684 B9DA.tmp 4708 BA38.tmp 876 BA86.tmp 984 BAD4.tmp 3976 BB32.tmp 2516 BB8F.tmp 2648 BBDE.tmp 1344 BC3B.tmp 3176 BC89.tmp 1684 BCE7.tmp 2720 BD35.tmp 3972 BD93.tmp 2864 BDE1.tmp 4008 BE2F.tmp 3776 BE7D.tmp 4308 BEDB.tmp 4200 BF29.tmp 976 BF77.tmp 5060 BFC6.tmp 4656 C014.tmp 4464 C062.tmp 2140 C0B0.tmp 4112 C0FE.tmp 3784 C15C.tmp 1452 C1BA.tmp 2272 C217.tmp 412 C275.tmp 1528 C2C3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1784 1420 2024-07-11_58025adfcb7e51ef74a0e9f503e32fc9_mafia.exe 83 PID 1420 wrote to memory of 1784 1420 2024-07-11_58025adfcb7e51ef74a0e9f503e32fc9_mafia.exe 83 PID 1420 wrote to memory of 1784 1420 2024-07-11_58025adfcb7e51ef74a0e9f503e32fc9_mafia.exe 83 PID 1784 wrote to memory of 2260 1784 ABA1.tmp 85 PID 1784 wrote to memory of 2260 1784 ABA1.tmp 85 PID 1784 wrote to memory of 2260 1784 ABA1.tmp 85 PID 2260 wrote to memory of 2448 2260 AC2E.tmp 87 PID 2260 wrote to memory of 2448 2260 AC2E.tmp 87 PID 2260 wrote to memory of 2448 2260 AC2E.tmp 87 PID 2448 wrote to memory of 3628 2448 ACAB.tmp 88 PID 2448 wrote to memory of 3628 2448 ACAB.tmp 88 PID 2448 wrote to memory of 3628 2448 ACAB.tmp 88 PID 3628 wrote to memory of 1108 3628 AD28.tmp 89 PID 3628 wrote to memory of 1108 3628 AD28.tmp 89 PID 3628 wrote to memory of 1108 3628 AD28.tmp 89 PID 1108 wrote to memory of 2692 1108 ADA5.tmp 90 PID 1108 wrote to memory of 2692 1108 ADA5.tmp 90 PID 1108 wrote to memory of 2692 1108 ADA5.tmp 90 PID 2692 wrote to memory of 2004 2692 AE22.tmp 91 PID 2692 wrote to memory of 2004 2692 AE22.tmp 91 PID 2692 wrote to memory of 2004 2692 AE22.tmp 91 PID 2004 wrote to memory of 1312 2004 AE9F.tmp 92 PID 2004 wrote to memory of 1312 2004 AE9F.tmp 92 PID 2004 wrote to memory of 1312 2004 AE9F.tmp 92 PID 1312 wrote to memory of 3996 1312 AEED.tmp 93 PID 1312 wrote to memory of 3996 1312 AEED.tmp 93 PID 1312 wrote to memory of 3996 1312 AEED.tmp 93 PID 3996 wrote to memory of 2680 3996 AF5A.tmp 94 PID 3996 wrote to memory of 2680 3996 AF5A.tmp 94 PID 3996 wrote to memory of 2680 3996 AF5A.tmp 94 PID 2680 wrote to memory of 348 2680 AFD7.tmp 95 PID 2680 wrote to memory of 348 2680 AFD7.tmp 95 PID 2680 wrote to memory of 348 2680 AFD7.tmp 95 PID 348 wrote to memory of 2736 348 B026.tmp 96 PID 348 wrote to memory of 2736 348 B026.tmp 96 PID 348 wrote to memory of 2736 348 B026.tmp 96 PID 2736 wrote to memory of 2348 2736 B083.tmp 97 PID 2736 wrote to memory of 2348 2736 B083.tmp 97 PID 2736 wrote to memory of 2348 2736 B083.tmp 97 PID 2348 wrote to memory of 4744 2348 B0E1.tmp 98 PID 2348 wrote to memory of 4744 2348 B0E1.tmp 98 PID 2348 wrote to memory of 4744 2348 B0E1.tmp 98 PID 4744 wrote to memory of 5016 4744 B12F.tmp 99 PID 4744 wrote to memory of 5016 4744 B12F.tmp 99 PID 4744 wrote to memory of 5016 4744 B12F.tmp 99 PID 5016 wrote to memory of 2860 5016 B19D.tmp 100 PID 5016 wrote to memory of 2860 5016 B19D.tmp 100 PID 5016 wrote to memory of 2860 5016 B19D.tmp 100 PID 2860 wrote to memory of 4484 2860 B20A.tmp 101 PID 2860 wrote to memory of 4484 2860 B20A.tmp 101 PID 2860 wrote to memory of 4484 2860 B20A.tmp 101 PID 4484 wrote to memory of 4960 4484 B277.tmp 102 PID 4484 wrote to memory of 4960 4484 B277.tmp 102 PID 4484 wrote to memory of 4960 4484 B277.tmp 102 PID 4960 wrote to memory of 4852 4960 B2C5.tmp 103 PID 4960 wrote to memory of 4852 4960 B2C5.tmp 103 PID 4960 wrote to memory of 4852 4960 B2C5.tmp 103 PID 4852 wrote to memory of 2320 4852 B333.tmp 104 PID 4852 wrote to memory of 2320 4852 B333.tmp 104 PID 4852 wrote to memory of 2320 4852 B333.tmp 104 PID 2320 wrote to memory of 644 2320 B381.tmp 105 PID 2320 wrote to memory of 644 2320 B381.tmp 105 PID 2320 wrote to memory of 644 2320 B381.tmp 105 PID 644 wrote to memory of 2228 644 B3CF.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-11_58025adfcb7e51ef74a0e9f503e32fc9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-11_58025adfcb7e51ef74a0e9f503e32fc9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"23⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"24⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"25⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"26⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"27⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"28⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"29⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"30⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"31⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"32⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"33⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"34⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"35⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"36⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"37⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"38⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"39⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"40⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"41⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"42⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"43⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"44⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"45⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"46⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"47⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"48⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"49⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"50⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"51⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"52⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"53⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"54⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"55⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"56⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"57⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"58⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"59⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"60⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"61⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"62⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"63⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"64⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"65⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"66⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"67⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"68⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"69⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"70⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"71⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"72⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"73⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"74⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"75⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"76⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"77⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"78⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"79⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"80⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"81⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"82⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"83⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"84⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"85⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"86⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"87⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"88⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"89⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"90⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"91⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"92⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"93⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"94⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"95⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"96⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"97⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"98⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"99⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"100⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"101⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"102⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"103⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"104⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"105⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"106⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"107⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"108⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"109⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"110⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"111⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"112⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"113⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"114⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"115⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"116⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"117⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"118⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"119⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"120⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"121⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"122⤵PID:3972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-